The Settings File I Kept Saying Yes To Had a Rule That Let Any Python Through — Auditing Allow Rules After the 2.1.309 Changelog
Claude Code 2.1.309 is full of permission-check and sandbox fixes. Here is a script that audits the allow rules in settings.local.json, and how to fix a prefix wildcard on an interpreter.
Passing the Request, Not the Secret — Where Sandbox Credential Masking Works and Where Substitution Breaks
Claude Code's sandbox credential masking lets processes read sentinel values while a proxy swaps in the real secret at send time. I rebuilt it as a minimal proxy and measured which auth schemes survive the swap, which break, what happens when the secret rides in the body, and where chunked framing makes the substitution miss entirely.
Tightening Filesystem Isolation Separately from the Network — Collect the Paths, Then Squeeze the Write Surface
Claude Code v2.1.216 lets you control filesystem isolation independently from network isolation. Before tightening anything, I traced what a real job actually touches, split reads from writes, and measured how stable the path set is across repeated runs. The numbers changed how I wrote the allowlist.
Locking down Claude Code sandbox egress with strictAllowlist
Tightening automation egress with strictAllowlist in Claude Code v2.1.219, plus measured failure timings that tell a policy deny from DNS and real outages, and three defects that made my own recon scripts return nothing.
Your Sandbox Can Run the Code but Shouldn't Read Your Credentials — Shrinking the Secret-Read Surface with sandbox.credentials
Claude Code's sandbox can still read ~/.aws/credentials and token env vars by default. Using sandbox.credentials (v2.1.187+), here is how I tightened the secret-read surface of unattended runs at the OS level, with config and verification you can reuse.
When Claude Code's Bash Tool Hits Permission Denied on /tmp — A $HOME/repos Fallback Pattern
A practical look at why git clone inside Claude Code's sandboxed Bash sometimes fails with Permission denied on /tmp, and how a tiny $HOME/repos fallback keeps unattended schedules alive across four indie sites.
When pip install Stops with externally-managed-environment in Cowork's Bash Sandbox — Three Patterns for PEP 668
Why pip install fails with externally-managed-environment in Cowork's Bash sandbox, and three practical fixes — --break-system-packages, venv, and pipx — written from real scheduled-task experience.
Claude Mythos in Production: A Deployment Playbook From Internals to Operations
Most Claude Mythos coverage stops at conceptual overviews. This playbook covers actual production deployment — System Card highlights that change implementation, gateway architecture, sandboxing, prompt-injection defense, monitoring, and scaling — with patterns from running Mythos-aware services.
How to Commit and Push via GitHub REST API When git CLI Fails in VM Environments
A practical guide to using GitHub REST API (blobs→trees→commits→refs) to push files when git CLI is blocked by index.lock, ownership errors, or permission issues in VM and sandbox environments.
Claude Mythos Explained — Understanding Anthropic's New Agent-Focused Product Through Its System Card
A deep dive into Claude Mythos, Anthropic's new sandboxed agent model. Covers the system card, sandbox architecture, comparison with general Claude models, and practical adoption scenarios.
Claude Managed Agents Sandbox Design: Running Autonomous Agents Safely in Production
A deep dive into the sandbox architecture of Claude Managed Agents, with production-ready security patterns and implementation code for running autonomous agents safely.